Insurance Offices

Compliance for insurance offices

An insurance file should evidence what the customer asked for, what was proposed, and which policy or disclosure version the customer received.

Legislation

Your obligations

Customer demands and needs, Law 4583/2018 and Directive (EU) 2016/97 Article 20

Before conclusion, the distributor identifies the customer's demands and needs and provides comprehensible product information. The proposal, disclosures, and IPID version form part of the evidence trail for the sale.

Information on a durable medium, Directive (EU) 2016/97 Article 23

When pre-contract information is delivered electronically, it must remain accessible for as long as the customer may reasonably need it. Backup should preserve the document and its version, not only a link to a third-party portal.

Suitability records for insurance-based investment products

For products within Delegated Regulation (EU) 2017/2359, Article 19 requires records of suitability or appropriateness assessments, customer information, and agreed documents for at least the duration of the customer relationship.

Health and claims data, GDPR Articles 9 and 32

Medical evidence, loss-adjuster reports, financial data, and identity documents do not all carry the same sensitivity. They require restricted access and a documented ability to restore availability in a timely manner.

Recovery design

What must recover for each case

An insurance office needs a coherent recovery of its sales and service history, not a disconnected collection of files.

Proposal, disclosures, and policy version

The demands-and-needs record, proposal, IPID, terms, endorsements, and delivery evidence should remain linked to the same customer and correct product version.

The claims file

Notifications, photographs, adjuster reports, medical evidence, and correspondence need tighter access controls and recovery priority for active claims.

Exports from insurer portals

Access to a provider portal is not a substitute for the office's own evidence file. Agreed exports and transaction receipts must be explicitly included in backup scope.

The applicable retention period depends on the product, customer relationship, any claim or dispute, and the office's professional or legal assessment. One blanket period is not stated for every record.

Practical answers

Questions from insurance offices

Why keep document versions from an insurance sale?

The file should show which need the office recorded, what it recommended, and which disclosure or policy version the customer received. Keeping only the latest file can remove the sequence that explains what applied at the time of the transaction.

How should health or claims documents be restored?

They should be restored into a controlled folder with permissions at least as strict as the original environment. Medical evidence, adjuster reports, and identity documents should not be restored to a general shared area simply for convenience.

Is the insurer's portal enough protection for policy records?

A third-party portal is a useful source, but it is not by itself a continuity plan for the office. The office does not control access, availability periods, or retained versions, and local needs records, correspondence, and claims files may not be present there.

The Fix

How ArvaSafe covers this

  • Backup of the customer, policy, and claims folders included in the written service scope
  • Separate assessment for CRM, insurance-distribution applications, and data held only in third-party portals
  • Retention, recovery priorities, and restore-test type per data category in the Order Form
  • Documentation limited to the technical and organisational measures ArvaSafe applies to the agreed service

Contact

Ready to sleep easier?

Two simple ways to get started. Pick whichever feels right, both reach me directly.

Option 1, Fastest

Book a 20-min call

Pick a time that suits you. I'll review your backup setup, answer service questions, and explain what ArvaSafe can address, no obligation.

  • Free 20-minute check
  • I review your current backup and technical evidence
  • You leave with a clear next step

Booking is provided by Google Calendar. Opening it sends technical information to Google.

Option 2, Send details

Send a written request

Prefer email? Tell me a bit about your business and what you need. I reply within 1 business day with a written quote.

Pick one or more

When you submit, your details are sent through Formspree so we can answer your enquiry and are retained for up to 12 months if no engagement begins. Read the Privacy Policy.